RHEL 10 : expat (RHSA-2026:74001)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74001 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute...

AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2025:1744631318)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744631318 advisory. - A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.2:CLSA-2026:1784191279)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784191279 advisory. - The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed...

Rocky Linux 9.6 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.6:CLSA-2026:1779124827)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779124827 advisory. - The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1776760883)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776760883 advisory. - A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling...

CentOS Linux 6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (CENTOS6:CLSA-2026:1778147777)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778147777 advisory. - In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an...

Rocky Linux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.6:CLSA-2026:1790177624)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790177624 advisory. - Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16...

RHEL 8 : rhc (RHSA-2026:73915)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:73915 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...

CVE-2026-96274 Uncaught exception in Baicells Nova 430H

In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdo...

CVE-2026-96274 Uncaught exception in Baicells Nova 430H

In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdo...

EUVD-2026-89358

In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdo...

GHSA-CXF4-7MRP-VVPR Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Related public issue context, not a duplicate Closed issue 1429 "Handle non-UTF-8 paths", 2024-03-24 raised exactly this general concern and even suggested detection via pregmatch'//u', $path !== 1 -- note the reporter's suggested check explicitly compares !== 1, which would correctly treat PCRE'...

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Related public issue context, not a duplicate Closed issue 1429 "Handle non-UTF-8 paths", 2024-03-24 raised exactly this general concern and even suggested detection via pregmatch'//u', $path !== 1 -- note the reporter's suggested check explicitly compares !== 1, which would correctly treat PCRE'...

CVE-2010-1205

CVE-2010-1205 취약점을 이용한 libpng =1.4.2 샘플 익스플로잇 gregbook - libpng 소스와 함께 배포되는 샘플 프로그램 세트 generate - libpng으로 파일을 읽을 때 힙 오버플로우를 유발하는 악성 png 파일 생성 재현 단계: ./build.sh 모든 라이브러리 및 실행 파일 빌드. gregbook/rpng2-x는 libpng-1.4.2 버그 있음와 링크됨 ./generate/build/generate xploit.png 생성 - 변조된 png 파일 cd gregbook/ ./rpng2...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601

The Flysystem PHP file storage library is vulnerable in versions prior to 3.35.3 due to a flaw in the WhitespacePathNormalizer component. The root cause is that preg_match with the u modifier treats false (returned during malformed UTF-8 input) as falsy, allowing paths containing control characte...

EUVD-2026-88998

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

expat security update

An update is available for expat. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Expat is a C library for parsing XML documents. Security Fixes: expat: Expat:...

Baicells Nova 430H

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to inject malformed messages which may lead to a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability...